18c43a3bff1f55fc5452b65ab12a46b6b60ffce8dae0768dfded3a185ccad941

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 23:43

Target

NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe
Size

260KB
MD5

1531f49513d932c9a0fb6deede64ba70
SHA1

c59c17813d7ba4ef56ef3fcb193f8244e9856c0b
SHA256

18c43a3bff1f55fc5452b65ab12a46b6b60ffce8dae0768dfded3a185ccad941
SHA512

aa87468674d9a4fa179b2f736a6d590a27ac94f6106c552d61c7212b926d3eb2695101dc566e9fdf9eff1d0b8fc243e81d47c46c5c8e6b0297c978664ed9c59f
SSDEEP

3072:+hbBS6u8DDyhLn9rn/kUBKrF1WdTCn93OGey/Zh:yBSiXyfrnYrGTCndOGeK

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2300	WerFault.exe	14

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2640	2300	NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe	28
PID 2300 wrote to memory of 2640	2300	NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe	28
PID 2300 wrote to memory of 2640	2300	NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe	28
PID 2300 wrote to memory of 2640	2300	NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1531f49513d932c9a0fb6deede64ba70_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2300 -s 36
  2⤵
  - Program crash
  PID:2640

memory/2300-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download